CVE-2025-24399
Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.
- Score
- CVSS 3.1 8.8 High
- Status
- Analyzed - jenkinsci-cert@googlegroups.com
- Published
- 2025-01-22
- Last modified
- 2025-03-18
- Weaknesses
- CWE-276
Affected products
- Openid Connect Authentication (Jenkins)
- Jenkins Openid Connect Authentication Plugin (Jenkins Project)
References
- https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3461
